PYSEC-2026-3044 pyzipper has an encryption bypass for small files encrypted using it

Impact A Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, regardless of file size or compression type. As a result, all encrypted entries are written in AE-1 format unless AE-2 is explicitly forced by the caller...

jupyterlab-zip (>=0.1.1, <=1.0.1) potentially affected by CVE-2026-42557 via jupyterlab (0.35.0rc2)

jupyterlab PYPI version 0.35.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jupyterlab-zip =0.1.1, =1.0.1 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...

jupyterlab-zip (>=0.1.1, <=1.0.1) potentially affected by CVE-2026-40171 via jupyterlab (0.35.0rc2)

jupyterlab PYPI version 0.35.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jupyterlab-zip =0.1.1, =1.0.1 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

PYSEC-2026-2875 pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources e.g., GitHub, the application uses Python's zipfile.extractall without verifying if the files within the archive resolve...

PYSEC-2026-2899 PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources e.g., GitHub, the application uses Python's zipfile.extractall without verifying if the files within the archive resolve...

PYSEC-2026-2856 OpenViking contains a Path Traversal vulnerability

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

Directory Traversal

Overview @makafeli/n8n-workflow-builder is a Model Context Protocol server for n8n workflow management Affected versions of this package are vulnerable to Directory Traversal in the updatenodefromfile of server.cjs when handling the filePath argument. An attacker can access arbitrary files and...

PT-2026-59536

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources e.g., GitHub, the application uses Python's zipfile.extractall without verifying if the files within the archive resolve...

PT-2026-59512

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

Debian dla-4681 : p7zip - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4681 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4681-1 [email protected]...

PT-2026-57866

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED...

PT-2026-59494

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

extract-zip Symbolic Link RCE

The vulnerability of the npm library extract-zip’s mechanism for handling symbolic links is related to errors in link processing. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-58052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an...

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability

...

GHSA-9MQM-QCWF-5QHG CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

Summary CredSweeper's deep scanner does not enforce recursivelimitsize as a hard limit. Several recursive scanners fully decompress or fully read attacker-controlled content before the remaining budget is validated, and AbstractScanner.recursivescan continues processing even when the residual...

EUVD-2026-42960

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloccentralHeader.size allocates memory based on the declared uncompressed size from the ZIP central directory header without...